Analysis
- max time kernel
148s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
03/08/2026, 09:21
General
- Target 2026-08-03_3bb51efc0ed9f05575274577cee86391_elex_wannacry.exe
- Size 92KB
- Sample260803-lbtabstbjb
- SHA256 291f91e93f0078ded7cbb4af327e4cb645dd000354c5c304fa44c47efbc07ec9
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_3bb51efc0ed9f05575274577cee86391_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_3bb51efc0ed9f05575274577cee86391_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D4834004-7DA4-4515-9D97-F99AB0B4DB12}.exeC:\Windows\{D4834004-7DA4-4515-9D97-F99AB0B4DB12}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D92B9241-42CE-4da1-B20A-65D21BA32CEE}.exeC:\Windows\{D92B9241-42CE-4da1-B20A-65D21BA32CEE}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6A29B781-14BB-4ffd-A456-D498064E34DF}.exeC:\Windows\{6A29B781-14BB-4ffd-A456-D498064E34DF}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7D450499-201B-4fd0-98B0-58D8EAB7E8EE}.exeC:\Windows\{7D450499-201B-4fd0-98B0-58D8EAB7E8EE}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BB622D6C-C276-4349-A1E7-FFCC17083C3B}.exeC:\Windows\{BB622D6C-C276-4349-A1E7-FFCC17083C3B}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{57EE816D-C6A1-4ffb-90AE-9233F3A63414}.exeC:\Windows\{57EE816D-C6A1-4ffb-90AE-9233F3A63414}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CF2DE8BE-52AA-4da2-AD55-686A358F9525}.exeC:\Windows\{CF2DE8BE-52AA-4da2-AD55-686A358F9525}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DEA629D2-E21A-441f-8180-C9D9253ACCAA}.exeC:\Windows\{DEA629D2-E21A-441f-8180-C9D9253ACCAA}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BC0459E4-BCA2-418b-9E05-1C5238783D61}.exeC:\Windows\{BC0459E4-BCA2-418b-9E05-1C5238783D61}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9B8F655E-627B-4d21-8B83-2C1B7C468A9A}.exeC:\Windows\{9B8F655E-627B-4d21-8B83-2C1B7C468A9A}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2FC95566-BEED-4441-B03F-10F9ECC11124}.exeC:\Windows\{2FC95566-BEED-4441-B03F-10F9ECC11124}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9B8F6~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BC045~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DEA62~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CF2DE~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{57EE8~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BB622~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7D450~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6A29B~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D92B9~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D4834~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{2FC95566-BEED-4441-B03F-10F9ECC11124}.exe
{57EE816D-C6A1-4ffb-90AE-9233F3A63414}.exe
{6A29B781-14BB-4ffd-A456-D498064E34DF}.exe
{7D450499-201B-4fd0-98B0-58D8EAB7E8EE}.exe
{9B8F655E-627B-4d21-8B83-2C1B7C468A9A}.exe
{BB622D6C-C276-4349-A1E7-FFCC17083C3B}.exe
{BC0459E4-BCA2-418b-9E05-1C5238783D61}.exe
{CF2DE8BE-52AA-4da2-AD55-686A358F9525}.exe
{D4834004-7DA4-4515-9D97-F99AB0B4DB12}.exe
{D92B9241-42CE-4da1-B20A-65D21BA32CEE}.exe
{DEA629D2-E21A-441f-8180-C9D9253ACCAA}.exe
memory/1552-21-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1552-23-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1552-27-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2000-64-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2000-57-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2380-71-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2380-76-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2636-34-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2636-29-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3928-63-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3928-69-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4368-12-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4368-6-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4492-14-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4492-19-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4600-42-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4600-36-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4628-0-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4628-8-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4628-1-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4692-78-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5212-55-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5212-50-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5588-48-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5588-43-0x0000000000400000-0x0000000000417000-memory.dmp